Deploying Encrypted DNS Internally: DoH and DoT Guide

I was on-call when it happened. 3 AM on a Tuesday, and every single production server in our us-east-1 region started resolving api.internal.example.com to a server in Belarus. Our recursive DNS resol